Severity.io | CVE-2020-1167

Description

A remote code execution vulnerability exists in the way that Microsoft Graphics Components handle objects in memory, aka 'Microsoft Graphics Components Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-16923.

Related CPE's

o microsoft windows_10 -*******

o microsoft windows_10 1607 *******

o microsoft windows_10 1709 *******

o microsoft windows_10 1803 *******

o microsoft windows_10 1809 *******

o microsoft windows_10 1903 *******

o microsoft windows_10 1909 *******

o microsoft windows_10 2004 *******

o microsoft windows_server_2016 -*******

o microsoft windows_server_2019 -*******

References

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1167

Patch

Vendor Advisory

https://www.zerodayinitiative.com/advisories/ZDI-20-1247/

Third Party Advisory

CvssV3 impact

BaseSeverity

HIGH

ConfidentialityImpact

HIGH

AttackComplexity

LOW

Scope

UNCHANGED

AttackVector

LOCAL

AvailabilityImpact

HIGH

IntegrityImpact

HIGH

PrivilegesRequired

NONE

BaseScore

7.8

VectorString

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Version

3.1

UserInteraction

REQUIRED

CvssV2 impact

AccessComplexity

MEDIUM

ConfidentialityImpact

COMPLETE

AvailabilityImpact

COMPLETE

IntegrityImpact

COMPLETE

BaseScore

9.3

VectorString

AV:N/AC:M/Au:N/C:C/I:C/A:C

Version

2.0

AccessVector

NETWORK

Authentication

NONE